Signature Base unknown stable yara

Methodology_Suspicious_Shortcut_Evasion [yara]

Non-standard .URLs and evasion

View Source

Detection Logic

any of ($filetype*) and $URI //and $URInegate
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Field Validations

Loading…

Comments (0)

Loading comments...